Senior Application Security Engineer (all genders)
Distribusion Technologies · Remote job · posted Sep 7, 2026
Open to candidates in 144 countries
Albania, Algeria, Andorra, Angola, Armenia, Australia, Austria, Bahrain, Bangladesh, Belarus, Belgium, Benin, Bhutan, Bosnia and Herzegovina, Botswana, Brunei, Bulgaria, Burkina Faso, Burundi, Cambodia, Cameroon, Canada, Cape Verde, Central African Republic, Chad, China, Comoros, Congo - Brazzaville, Congo - Kinshasa, Croatia, Cyprus, Czechia, Denmark, Djibouti, Egypt, Equatorial Guinea, Eritrea, Estonia, Eswatini, Ethiopia, Fiji, Finland, France, Gabon, Gambia, Georgia, Germany, Ghana, Gibraltar, Greece, Guinea, Guinea-Bissau, Hong Kong, Hungary, Iceland, India, Indonesia, Iraq, Ireland, Israel, Italy, Ivory Coast, Japan, Jordan, Kenya, Kosovo, Kuwait, Laos, Latvia, Lebanon, Lesotho, Liberia, Libya, Liechtenstein, Lithuania, Luxembourg, Macao SAR China, Madagascar, Malawi, Malaysia, Maldives, Mali, Malta, Mauritania, Mauritius, Mexico, Moldova, Monaco, Mongolia, Montenegro, Morocco, Mozambique, Myanmar, Namibia, Nepal, Netherlands, New Zealand, Niger, Nigeria, North Macedonia, Norway, Oman, Pakistan, Papua New Guinea, Philippines, Poland, Portugal, Qatar, Romania, Rwanda, San Marino, Saudi Arabia, Senegal, Serbia, Seychelles, Sierra Leone, Singapore, Slovakia, Slovenia, Somalia, South Africa, South Korea, South Sudan, Spain, Sri Lanka, Sudan, Sweden, Switzerland, São Tomé & Príncipe, Taiwan, Tanzania, Thailand, Timor-Leste, Togo, Tunisia, Türkiye, Uganda, Ukraine, United Arab Emirates, United Kingdom, United States, Vietnam, Zambia, Zimbabwe
More remote jobs open to candidates in India, Vietnam, Indonesia, Pakistan, Nigeria, Bangladesh, Malaysia, Philippines, Kenya, Ghana, Egypt, South Africa, Mexico, Turkey, Ukraine, Sri Lanka and Nepal
You apply on the company's own site. We never charge to apply.
What this role actually asks for
Extracted by RemoteHuntMust have
- •Lead threat modeling and secure design reviews
- •Implement security gates in CI/CD
- •Triage and prioritize security findings
- •Work with DevOps on GCP security
- •Establish security champions network
Nice to have
- •Experience with active bug bounties
- •Experience with payment flows
Tools and technologies
The full posting
Distribusion is the world’s leading ground transportation marketplace and gives travellers seamless access to ground transportation online, from search to ticket purchase. We have built a cutting-edge B2B technology platform that connects bus, rail and ferry operators in 70+ countries with the biggest online retailers including Google Maps and Booking.com.
We are shaping the future of travel and building the largest global network of transport providers and retailers. We are one of the fastest growing startups in travel, backed by leading venture capital investors including TQ Ventures, Lightrock, Creandum, and Northzone, and are headquartered in Berlin, Germany.
Following our recent $80m Series C funding, we are ready to push beyond. We are looking for our first dedicated Application Security Engineer to build our AppSec practice from the ground up. This is a greenfield opportunity with a real attack surface: public partner-facing APIs and payment flows. You will own secure development, define what gets reviewed, implement security gates, build the "paved road" for ~150 engineers, and see the impact of your work in production within weeks.
What you will do
Lead threat modeling and secure design reviews for high-risk changes, partner integrations, and payment flows. Implement, tune, and enforce security gates in GitLab CI/CD (SAST, SCA, secrets scanning, and DAST) while minimizing developer friction. Act as the primary technical owner for triaging, reproducing, and prioritizing findings from bug bounties, partner pentests, and automated scanners.
Work hands-on with the DevOps team to implement GCP organizational policies, IAM least-privilege architectures, and Cloud Armor (WAF/rate limiting). Establish a security-champions network across engineering squads and leverage automation/AI-assisted tooling to scale code reviews effectively.
Own vulnerability management end to end: a risk-ranked backlog, remediation SLAs, an escalation path, and closing findings together with the teams. Scope and coordinate the annual external penetration test and produce secure-development evidence for PCI-DSS and ISO 27001. Workplace: We are a remote-first company with teams located around the Globe. Also, the HQ office is in Berlin, where the team often meets.
More remote jobs for the Philippines on Telegram → @RemoteHuntAsia
Similar remote jobs
More remote jobs open to candidates in
Get new jobs like this by email
Once a week. Remote security engineer jobs that can hire you in your country.
Is this one actually worth your time?
RemoteHunt scores every remote job 0–100 against your own resume, so you apply to the handful that fit instead of the hundred that don't. Free plan, no card required.